Bug 134791

Summary: Amazon.com product pages: redirect to ad (javascript:location.replace)
Product: [Applications] konqueror Reporter: Chase Venters <chase.venters>
Component: khtmlAssignee: Konqueror Bugs <konqueror-bugs-null>
Status: RESOLVED FIXED    
Severity: major CC: maksim
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: Gentoo Packages   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description Chase Venters 2006-09-28 17:07:51 UTC 
Version:            (using KDE KDE 3.5.4)
Installed from:    Gentoo Packages
OS:                Linux

Visiting any product page on Amazon.com recently, I noticed that upon fully loading, I am getting redirected immediately to an advertisement, such as this URL:

http://ad.doubleclick.net/adi/amazon.pilot/;cid=3619312;sz=125x125;ord=2156?

I looked at the source code of the product page to see if I could determine what is going on, and I think I know a likely culprit. They have an IFRAME:

<iframe marginheight="0" marginwidth="0" style="width:125px; height:125px;" height="125" width="125" src="javascript:location.replace('http://ad.doubleclick.net/adi/amazon.pilot/;cid=3619312;sz=125x125;ord='+Math.floor(Math.random()*10000)+'?')" scrolling="no" frameborder="0">

Now, in other browsers I've tested, that location.replace gets evaluated inside the iframe itself. But Konqueror appears to be evaluating it inside the surrounding frame. 

I'm not sure if the evaluation context is defined by a standard. I would suspect that the Konqueror behavior is more sensical; but apparently other browsers handle it differently. I have sent a nastygram to Amazon about this and am trying to get it pushed through the thick mud of thick customer service representatives in the hope it might eventually make it to someone with a clue, because I think that was a rather poor implementation choice on their part to begin with.

But I thought I'd report that here too in case that really is a problem with Konqueror.
Comment 1 Maksim Orlovich 2006-09-28 17:45:12 UTC 
If we do it different from other browsers, it is our problem :-(

I think there was some thread on kfm-devel about it, I'll see if there is a way we can fix it quicky...
Comment 2 Maksim Orlovich 2006-09-28 18:09:37 UTC 
Do you have an example URL of where this happens, BTW?
Comment 4 Maksim Orlovich 2006-09-28 23:30:02 UTC 
Yep :-(. Wonder what subset of pages this affects, but sounds like a high-priority bug.
Comment 5 Chase Venters 2006-09-28 23:42:33 UTC 
Please be advised that I lit a fire under Amazon's ass about using javascript:location.replace() in that way, so our live example may disappear sooner or later. I'll save a copy of the page off so that there is a reference in case I misjudged what the problem is.
Comment 6 Maksim Orlovich 2006-09-29 03:10:07 UTC 
I have a start on it, but it's a very messy feature....

for example the following are all possible, and behave as following in other browsers:
<iframe src='javascript:"Foo"'>  --- writes 'Foo' in the new page
<iframe src='javascript:"Foo" + document.body.appendChild(document.createTextNode("bar")'>  --- in mozilla and opera writes Foo[object Text], error about being unable to find body in IE
<iframe src='javascript:"Foo" + document.write('hi')'> --- 'hi' everywhere(!).

etc. So I don't yet have a good model of what's going on here...
Comment 7 Maksim Orlovich 2006-09-30 16:35:32 UTC 
SVN commit 590600 by orlovich:

Evaluate scripts in <iframe src=javascript:..> in the right context.
Affects amazon and freemail.hu
BUG:134791
BUG:106748



 M  +13 -6     khtml_part.cpp  


--- branches/KDE/3.5/kdelibs/khtml/khtml_part.cpp #590599:590600
@@ -4314,12 +4314,19 @@
   // Support for <frame src="javascript:string">
   if ( url.find( QString::fromLatin1( "javascript:" ), 0, false ) == 0 )
   {
-      QVariant res = executeScript( DOM::Node(frame->element()), KURL::decode_string( url.right( url.length() - 11) ) );
-      KURL myurl;
-      myurl.setProtocol("javascript");
-      if ( res.type() == QVariant::String )
-	myurl.setPath(res.asString());
-      return processObjectRequest(*it, myurl, QString("text/html") );
+    if ( processObjectRequest(*it, KURL("about:blank"), QString("text/html") ) ) {
+      KHTMLPart* p = static_cast<KHTMLPart*>(static_cast<KParts::ReadOnlyPart *>((*it)->m_part));
+      
+      // See if we want to replace content with javascript: output..
+      QVariant res = p->executeScript( DOM::Node(), KURL::decode_string( url.right( url.length() - 11) ) );
+      if ( res.type() == QVariant::String ) {
+        p->begin();
+        p->write( res.asString() );
+        p->end();
+      }
+      return true;
+    }
+    return false;
   }
   KURL u = url.isEmpty() ? KURL() : completeURL( url );
   return requestObject( *it, u );